Leave the card description out of the moved-cards mail
Build package / xml-lint (push) Successful in 30s
Build package / unit-tests (push) Successful in 1m14s
Build package / php-lint (8.4) (push) Successful in 55s
Build package / php-lint (8.5) (push) Successful in 56s
Build package / package (push) Successful in 1m17s

This commit is contained in:
Patrick Niebeling committed 2026-09-30 10:41:20 +02:00
1 parent 1ffc0765ea
commit 860e8b7bbb
1 file changed
+1 -37
+1 -37
View File
@@ -31,12 +31,6 @@ class NotificationMailer {
*/
private const FOOTER_LANGUAGE = 'de';
/**
* Descriptions are unbounded in Deck; keep the mail readable and well
* clear of any MTA size limits.
*/
private const MAX_DESCRIPTION_LENGTH = 2000;
public function __construct(
private IMailer $mailer,
private IURLGenerator $urlGenerator,
@@ -106,7 +100,7 @@ class NotificationMailer {
private function addCard(IEMailTemplate $template, Workflow $workflow, Card $card, array $targets): void {
// Single-argument addBodyText() runs htmlspecialchars() itself, so
// these card-, workflow-, board- and stack-titles (user input) are
// safe as-is — unlike the description below, which passes both parts.
// safe as-is. The card description is deliberately left out.
$template->addBodyText(sprintf(
'Die Karte „%1$s“ wurde verschoben, weil sie überfällig ist (Workflow „%2$s“).',
$card->getTitle(),
@@ -118,7 +112,6 @@ class NotificationMailer {
$targets['sourceStack'],
$targets['targetStack'],
));
$this->addCardDescription($template, $card);
$template->addBodyButton(
'Karte öffnen',
$this->urlGenerator->getAbsoluteURL('/apps/deck/board/' . $workflow->getBoardId() . '/card/' . $card->getId()),
@@ -184,33 +177,4 @@ class NotificationMailer {
]);
}
}
/**
* Appends the card's description, if it has one.
*
* Deck stores the description as Markdown. It is sent as-is rather than
* rendered: pulling a Markdown parser in just for the mail would be a
* lot of machinery, and unrendered Markdown still reads fine.
*/
private function addCardDescription(IEMailTemplate $template, Card $card): void {
$description = trim((string)$card->getDescription());
if ($description === '') {
return;
}
if (mb_strlen($description) > self::MAX_DESCRIPTION_LENGTH) {
$description = mb_substr($description, 0, self::MAX_DESCRIPTION_LENGTH) . ' […]';
}
$template->addBodyText('Karteninhalt:');
// addBodyText() only runs htmlspecialchars() when it has to build the
// plain-text part itself. Passing both parts means escaping is on us
// -- and it has to be, because a card description is user input that
// would otherwise land unescaped in the HTML mail.
$template->addBodyText(
nl2br(htmlspecialchars($description, ENT_QUOTES, 'UTF-8'), false),
$description,
);
}
}